Merge pull request #3574 from fosrl/dev

1.21.1-s.5

messages/en-US.json

@@ -43,6 +43,8 @@
     "inviteLoginUser": "Please make sure you're logged in as the correct user.",
     "inviteErrorNoUser": "We're sorry, but it looks like the invite you're trying to access is not for a user that exists.",
     "inviteCreateUser": "Please create an account first.",
+    "inviteErrorOidcNotAllowed": "Invites can only be accepted by internal accounts. Sign out and log in with your password for this email.",
+    "inviteLoginInternalOnly": "Invites require an internal account with a password. Create an account or sign in with your password.",
     "goHome": "Go Home",
     "inviteLogInOtherUser": "Log In as a Different User",
     "createAnAccount": "Create an Account",
@@ -1449,8 +1451,11 @@
     "actionSetResourcePincode": "Set Resource Pincode",
     "actionSetResourceEmailWhitelist": "Set Resource Email Whitelist",
     "actionGetResourceEmailWhitelist": "Get Resource Email Whitelist",
+    "actionListResourcePolicies": "List Resource Policies",
+    "actionCreateResourcePolicy": "Create Resource Policy",
     "actionGetResourcePolicy": "Get Resource Policy",
     "actionUpdateResourcePolicy": "Update Resource Policy",
+    "actionDeleteResourcePolicy": "Delete Resource Policy",
     "actionSetResourcePolicyUsers": "Set Resource Policy Users",
     "actionSetResourcePolicyRoles": "Set Resource Policy Roles",
     "actionSetResourcePolicyPassword": "Set Resource Policy Password",

server/db/pg/schema/privateSchema.ts

@@ -95,7 +95,8 @@ export const subscriptions = pgTable("subscriptions", {
     billingCycleAnchor: bigint("billingCycleAnchor", { mode: "number" }),
     expiresAt: bigint("expiresAt", { mode: "number" }),
     trial: boolean("trial").default(false),
-    type: varchar("type", { length: 50 }) // tier1, tier2, tier3, or license
+    type: varchar("type", { length: 50 }), // tier1, tier2, tier3, or license
+    override: boolean("override").default(false)
 });
 
 export const subscriptionItems = pgTable("subscriptionItems", {

server/db/sqlite/schema/privateSchema.ts

@@ -89,7 +89,8 @@ export const subscriptions = sqliteTable("subscriptions", {
     expiresAt: integer("expiresAt"),
     trial: integer("trial", { mode: "boolean" }).default(false),
     billingCycleAnchor: integer("billingCycleAnchor"),
-    type: text("type") // tier1, tier2, tier3, or license
+    type: text("type"), // tier1, tier2, tier3, or license
+    override: integer("override", { mode: "boolean" }).default(false)
 });
 
 export const subscriptionItems = sqliteTable("subscriptionItems", {

server/lib/blueprints/types.ts

@@ -632,7 +632,6 @@ export const ResourcePolicySchema = z.object({
                 })
             )
         )
-        .max(50)
         .transform((v) => v.map((e) => e.toLowerCase()))
         .optional()
         .default([]),

server/lib/idp/idpExistsForOrg.ts

@@ -1,8 +1,9 @@
 import { db, idp, idpOrg, Transaction } from "@server/db";
 import { and, eq } from "drizzle-orm";
+import { build } from "@server/build";
 
 export function isOrgIdentityProviderMode(): boolean {
-    return process.env.IDENTITY_PROVIDER_MODE === "org";
+    return build === "saas" || process.env.IDENTITY_PROVIDER_MODE === "org";
 }
 
 /**

server/lib/readConfigFile.ts

@@ -258,7 +258,24 @@ export const configSchema = z
                 pp_transport_prefix: z
                     .string()
                     .optional()
-                    .default("pp-transport-v")
+                    .default("pp-transport-v"),
+                rate_limit: z
+                    .object({
+                        average: z
+                            .number()
+                            .positive()
+                            .gt(0)
+                            .optional()
+                            .default(30),
+                        burst: z
+                            .number()
+                            .positive()
+                            .gt(0)
+                            .optional()
+                            .default(50)
+                    })
+                    .optional()
+                    .prefault({})
             })
             .optional()
             .prefault({}),

server/private/lib/traefik/getTraefikConfig.ts

@@ -58,6 +58,8 @@ import { build } from "@server/build";
 const redirectHttpsMiddlewareName = "redirect-to-https";
 const redirectToRootMiddlewareName = "redirect-to-root";
 const badgerMiddlewareName = "badger";
+const landingRateLimitMiddlewareName = "landing-ratelimit";
+const bgRateLimitMiddlewareName = "bg-ratelimit";
 
 // Define extended target type with site information
 type TargetWithSite = Target & {
@@ -418,6 +420,8 @@ export async function getTraefikConfig(
         // logger.debug(`Valid certs for domains: ${JSON.stringify(validCerts)}`);
     }
 
+    const traefikRateLimit = config.getRawConfig().traefik.rate_limit;
+
     const config_output: any = {
         http: {
             middlewares: {
@@ -432,6 +436,18 @@ export async function getTraefikConfig(
                         replacement: "${1}://${2}/auth/org",
                         permanent: false
                     }
+                },
+                [landingRateLimitMiddlewareName]: {
+                    rateLimit: {
+                        average: traefikRateLimit.average,
+                        burst: traefikRateLimit.burst
+                    }
+                },
+                [bgRateLimitMiddlewareName]: {
+                    rateLimit: {
+                        average: traefikRateLimit.average,
+                        burst: traefikRateLimit.burst
+                    }
                 }
             }
         }
@@ -1055,6 +1071,7 @@ export async function getTraefikConfig(
                 config.getRawConfig().traefik.additional_middlewares || [];
             const routerMiddlewares = [
                 badgerMiddlewareName,
+                bgRateLimitMiddlewareName,
                 ...additionalMiddlewares
             ];
 
@@ -1539,6 +1556,7 @@ export async function getTraefikConfig(
                     entryPoints: [
                         config.getRawConfig().traefik.https_entrypoint
                     ],
+                    middlewares: [landingRateLimitMiddlewareName],
                     service: "landing-service",
                     rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
                     priority: 203,
@@ -1557,7 +1575,10 @@ export async function getTraefikConfig(
                     entryPoints: [
                         config.getRawConfig().traefik.https_entrypoint
                     ],
-                    middlewares: [redirectToRootMiddlewareName],
+                    middlewares: [
+                        landingRateLimitMiddlewareName,
+                        redirectToRootMiddlewareName
+                    ],
                     service: "landing-service",
                     rule: `Host(\`${fullDomain}\`)`,
                     priority: 202,

server/private/routers/billing/hooks/handleSubscriptionDeleted.ts

@@ -53,6 +53,15 @@ export async function handleSubscriptionDeleted(
             return;
         }
 
+        // If the subscription has been manually overridden, we lock it down
+        // so Stripe can no longer change (or delete) its status locally.
+        if (existingSubscription.override === true) {
+            logger.info(
+                `Subscription ${subscription.id} is locked (override=true). Ignoring deletion event from Stripe.`
+            );
+            return;
+        }
+
         await db
             .delete(subscriptions)
             .where(eq(subscriptions.subscriptionId, subscription.id));

server/private/routers/billing/hooks/handleSubscriptionUpdated.ts

@@ -68,13 +68,27 @@ export async function handleSubscriptionUpdated(
         const type = getSubType(fullSubscription);
         const previousType = existingSubscription.type as SubscriptionType | null;
 
+        // If the subscription has been manually overridden, we lock the
+        // status down so Stripe webhooks can no longer change it.
+        const isLocked = existingSubscription.override === true;
+        if (isLocked) {
+            logger.info(
+                `Subscription ${subscription.id} is locked (override=true). Ignoring status change from Stripe (would have been ${subscription.status}).`
+            );
+        }
+        const effectiveStatus = isLocked
+            ? existingSubscription.status
+            : subscription.status;
+
         await db
             .update(subscriptions)
             .set({
-                status: subscription.status,
-                canceledAt: subscription.canceled_at
-                    ? subscription.canceled_at
-                    : null,
+                status: effectiveStatus,
+                canceledAt: isLocked
+                    ? existingSubscription.canceledAt
+                    : subscription.canceled_at
+                      ? subscription.canceled_at
+                      : null,
                 updatedAt: Math.floor(Date.now() / 1000),
                 billingCycleAnchor: subscription.billing_cycle_anchor,
                 type: type
@@ -275,23 +289,23 @@ export async function handleSubscriptionUpdated(
                 // we only need to handle the limit lifecycle for saas subscriptions not for the licenses
                 await handleSubscriptionLifesycle(
                     customer.orgId,
-                    subscription.status,
+                    effectiveStatus,
                     type
                 );
 
                 // Handle feature lifecycle when subscription is canceled or becomes unpaid
                 if (
-                    subscription.status === "canceled" ||
-                    subscription.status === "unpaid" ||
-                    subscription.status === "incomplete_expired"
+                    effectiveStatus === "canceled" ||
+                    effectiveStatus === "unpaid" ||
+                    effectiveStatus === "incomplete_expired"
                 ) {
                     logger.info(
-                        `Subscription ${subscription.id} for org ${customer.orgId} is ${subscription.status}, disabling paid features`
+                        `Subscription ${subscription.id} for org ${customer.orgId} is ${effectiveStatus}, disabling paid features`
                     );
                     await handleTierChange(customer.orgId, null, previousType ?? undefined);
                 }
             } else if (type === "license") {
-                if (subscription.status === "canceled" || subscription.status == "unpaid" || subscription.status == "incomplete_expired") {
+                if (effectiveStatus === "canceled" || effectiveStatus == "unpaid" || effectiveStatus == "incomplete_expired") {
                     try {
                         // WARNING:
                         // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId

server/private/routers/certificates/getBatchedCertificates.ts

@@ -10,12 +10,12 @@
  *
  * This file is not licensed under the AGPLv3.
  */
-import { certificates, db, domains, orgDomains } from "@server/db";
+import { certificates, db, domainNamespaces, domains, orgDomains } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, or } from "drizzle-orm";
+import { and, eq, inArray, isNotNull, or } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -46,7 +46,7 @@ const getCertificateQuerySchema = z.object({
 
 async function query(orgId: string, domainList: string[]) {
     // Try to get CNAME certificates first
-    let existingCertificates = await db
+    const existingCertificates = await db
         .select({
             certId: certificates.certId,
             domain: certificates.domain,
@@ -63,26 +63,43 @@ async function query(orgId: string, domainList: string[]) {
         })
         .from(certificates)
         .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-        .innerJoin(
+        .leftJoin(
             orgDomains,
             and(
                 eq(domains.domainId, orgDomains.domainId),
                 eq(orgDomains.orgId, orgId)
             )
         )
-        .where(and(inArray(certificates.domain, domainList)));
+        .leftJoin(
+            domainNamespaces,
+            eq(domains.domainId, domainNamespaces.domainId)
+        )
+        .where(
+            and(
+                inArray(certificates.domain, domainList),
+                // Namespace domains are shared across all orgs, so they skip
+                // the org-ownership check (mirrors verifyCertificateAccess).
+                or(
+                    isNotNull(orgDomains.orgId),
+                    isNotNull(domainNamespaces.domainNamespaceId)
+                )
+            )
+        );
 
     // All non resolved domain certificates might be `ns` or `wildcard`,
-    // which means exact domain certificates do not
-    const nonAvailableCertificates = existingCertificates
-        .filter((cert) => !domainList.includes(cert.domain))
-        .map((cert) => cert.domain);
+    // which means exact domain certificates do not exist
+    const foundDomains = new Set(
+        existingCertificates.map((cert) => cert.domain)
+    );
+    const domainsWithMissingCertificates = domainList.filter(
+        (domain) => !foundDomains.has(domain)
+    );
 
-    if (nonAvailableCertificates.length > 0) {
+    if (domainsWithMissingCertificates.length > 0) {
         const domainLevelDownSet = new Set<string>();
         const wildcardDomainSet = new Set<string>();
 
-        for (const domain of nonAvailableCertificates) {
+        for (const domain of domainsWithMissingCertificates) {
             const domainLevelDown = domain.split(".").slice(1).join(".");
             const wildcardPrefixed = `*.${domainLevelDown}`;
             domainLevelDownSet.add(domainLevelDown);
@@ -107,19 +124,27 @@ async function query(orgId: string, domainList: string[]) {
             })
             .from(certificates)
             .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-            .innerJoin(
+            .leftJoin(
                 orgDomains,
                 and(
                     eq(domains.domainId, orgDomains.domainId),
                     eq(orgDomains.orgId, orgId)
                 )
             )
+            .leftJoin(
+                domainNamespaces,
+                eq(domains.domainId, domainNamespaces.domainId)
+            )
             .where(
                 and(
                     eq(certificates.wildcard, true),
                     or(
                         inArray(certificates.domain, [...domainLevelDownSet]),
                         inArray(certificates.domain, [...wildcardDomainSet])
+                    ),
+                    or(
+                        isNotNull(orgDomains.orgId),
+                        isNotNull(domainNamespaces.domainNamespaceId)
                     )
                 )
             );
@@ -131,6 +156,7 @@ async function query(orgId: string, domainList: string[]) {
     for (const domain of domainList) {
         const domainLevelDown = domain.split(".").slice(1).join(".");
         const wildcardPrefixed = `*.${domainLevelDown}`;
+
         certificateMap[domain] =
             existingCertificates.find(
                 (cert) =>

server/private/routers/policy/createResourcePolicy.ts

@@ -107,7 +107,6 @@ const createResourcePolicyBodySchema = z.strictObject({
                 })
             )
         )
-        .max(50)
         .transform((v) => v.map((e) => e.toLowerCase()))
         .optional()
         .default([]),

server/routers/badger/verifySession.ts

@@ -127,6 +127,9 @@ export async function verifyResourceSession(
         // Extract HTTP Basic Auth credentials if present
         const clientHeaderAuth = extractBasicAuth(headers);
 
+        const clientUserAgent = headers?.["user-agent"] || headers?.["User-Agent"];
+        const clientIsBrowser = isBrowserUserAgent(clientUserAgent);
+
         const clientIp = requestIp
             ? stripPortFromHost(requestIp, badgerVersion)
             : undefined;
@@ -313,9 +316,14 @@ export async function verifyResourceSession(
             return allowed(res, undefined, dontStripSession);
         }
 
-        const redirectPath = `/auth/resource/${encodeURIComponent(
-            resource.resourceGuid
-        )}?redirect=${encodeURIComponent(originalRequestURL)}`;
+        // Only offer a browser redirect to clients that can actually follow one and log in
+        // (an interactive browser). Non-browser clients (curl, scripts, bots, etc.) just get
+        // an unauthorized response from Badger instead of a login redirect URL.
+        const redirectPath = clientIsBrowser
+            ? `/auth/resource/${encodeURIComponent(
+                  resource.resourceGuid
+              )}?redirect=${encodeURIComponent(originalRequestURL)}`
+            : undefined;
 
         // check for access token in headers
         if (
@@ -1476,6 +1484,46 @@ async function getCountryCodeFromIp(ip: string): Promise<string | undefined> {
     return cachedCountryCode;
 }
 
+// Permissive by default: only reject known non-browser clients or a missing
+// User-Agent (real browsers always send one). This avoids blocking real
+// browsers whose UA string doesn't match a hardcoded allow-list.
+const NON_BROWSER_USER_AGENT_PATTERNS = [
+    /curl/,
+    /wget/,
+    /python-requests/,
+    /python-urllib/,
+    /go-http-client/,
+    /okhttp/,
+    /axios/,
+    /node-fetch/,
+    /postmanruntime/,
+    /insomnia/,
+    /libwww-perl/,
+    /java\//,
+    /ruby/,
+    /php/,
+    /bot/,
+    /spider/,
+    /crawler/,
+    /headlesschrome/,
+    /phantomjs/,
+    /httpclient/,
+    /prometheus/,
+    /go-resty/,
+    /apache-httpclient/,
+    /scrapy/
+];
+
+function isBrowserUserAgent(userAgent: string | undefined): boolean {
+    if (!userAgent) {
+        return false;
+    }
+
+    const ua = userAgent.toLowerCase();
+
+    return !NON_BROWSER_USER_AGENT_PATTERNS.some((pattern) => pattern.test(ua));
+}
+
 function extractBasicAuth(
     headers: Record<string, string> | undefined
 ): string | undefined {

server/routers/client/listUserDevices.ts

@@ -67,12 +67,12 @@ const listUserDevicesSchema = z.strictObject({
         }),
     query: z.string().optional(),
     sort_by: z
-        .enum(["megabytesIn", "megabytesOut"])
+        .enum(["megabytesIn", "megabytesOut", "firstSeen", "lastSeen"])
         .optional()
         .catch(undefined)
         .openapi({
             type: "string",
-            enum: ["megabytesIn", "megabytesOut"],
+            enum: ["megabytesIn", "megabytesOut", "firstSeen", "lastSeen"],
             description: "Field to sort by"
         }),
     order: z
@@ -183,7 +183,9 @@ function queryUserDevicesBase() {
             fingerprintArch: currentFingerprint.arch,
             fingerprintSerialNumber: currentFingerprint.serialNumber,
             fingerprintUsername: currentFingerprint.username,
-            fingerprintHostname: currentFingerprint.hostname
+            fingerprintHostname: currentFingerprint.hostname,
+            firstSeen: currentFingerprint.firstSeen,
+            lastSeen: currentFingerprint.lastSeen
         })
         .from(clients)
         .leftJoin(orgs, eq(clients.orgId, orgs.orgId))
@@ -389,14 +391,23 @@ export async function listUserDevices(
 
         const countQuery = db.$count(baseQuery.as("filtered_clients"));
 
+        const sortColumn =
+            sort_by === "firstSeen"
+                ? currentFingerprint.firstSeen
+                : sort_by === "lastSeen"
+                  ? currentFingerprint.lastSeen
+                  : sort_by
+                    ? clients[sort_by]
+                    : undefined;
+
         const listDevicesQuery = baseQuery
             .limit(pageSize)
             .offset(pageSize * (page - 1))
             .orderBy(
-                sort_by
+                sortColumn
                     ? order === "asc"
-                        ? asc(clients[sort_by])
-                        : desc(clients[sort_by])
+                        ? asc(sortColumn)
+                        : desc(sortColumn)
                     : asc(clients.clientId)
             );
 

server/routers/gerbil/updateHolePunch.ts

@@ -112,7 +112,9 @@ export async function updateHolePunch(
             destinations: destinations
         });
     } catch (error) {
-        logger.error(error);
+        if (!(error instanceof Error && error.message === "Exit node not allowed")) {
+            logger.error(error);
+        }
         return next(
             createHttpError(
                 HttpCode.INTERNAL_SERVER_ERROR,

server/routers/integration.ts

@@ -726,8 +726,8 @@ authenticated.post(
     verifyApiKeyResourcePolicyAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
+    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers),
+    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles),
     logActionAudit(ActionsEnum.setResourcePolicyUsers),
     logActionAudit(ActionsEnum.setResourcePolicyRoles),
     policy.setResourcePolicyAccessControl
@@ -742,8 +742,8 @@ authenticated.put(
     verifyApiKeyResourcePolicyAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
+    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers),
+    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles),
     logActionAudit(ActionsEnum.setResourcePolicyUsers),
     logActionAudit(ActionsEnum.setResourcePolicyRoles),
     policy.setResourcePolicyAccessControl

server/routers/policy/setResourcePolicyWhitelist.ts

@@ -19,7 +19,6 @@ const setResourcePolicyWhitelistBodySchema = z.strictObject({
                 })
             )
         )
-        .max(50)
         .transform((v) => v.map((e) => e.toLowerCase()))
 });
 

server/routers/resource/setResourceWhitelist.ts

@@ -24,7 +24,6 @@ const setResourceWhitelistBodySchema = z.strictObject({
                 })
             )
         )
-        .max(50)
         .transform((v) => v.map((e) => e.toLowerCase()))
 });
 

server/routers/role/createRole.ts

@@ -34,7 +34,9 @@ const createRoleSchema = z.strictObject({
 export const defaultRoleAllowedActions: ActionsEnum[] = [
     ActionsEnum.getOrg,
     ActionsEnum.getResource,
-    ActionsEnum.listResources
+    ActionsEnum.listResources,
+    ActionsEnum.getSiteResource,
+    ActionsEnum.listSiteResources
 ];
 
 export type CreateRoleBody = z.infer<typeof createRoleSchema>;

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -3,11 +3,13 @@ import {
     DB_TYPE,
     Label,
     SiteResource,
+    roleSiteResources,
     siteNetworks,
     siteResourceLabels,
     siteResources,
     sites,
-    labels
+    labels,
+    userSiteResources
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
@@ -323,7 +325,48 @@ export async function listAllSiteResourcesByOrg(
             labels: labelFilter
         } = parsedQuery.data;
 
-        const conditions = [and(eq(siteResources.orgId, orgId))];
+        let accessibleSiteResourceIds: number[];
+        if (req.user) {
+            const accessibleSiteResources = await db
+                .select({
+                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
+                })
+                .from(userSiteResources)
+                .fullJoin(
+                    roleSiteResources,
+                    eq(
+                        userSiteResources.siteResourceId,
+                        roleSiteResources.siteResourceId
+                    )
+                )
+                .where(
+                    or(
+                        eq(userSiteResources.userId, req.user.userId),
+                        inArray(
+                            roleSiteResources.roleId,
+                            req.userOrgRoleIds ?? []
+                        )
+                    )
+                );
+            accessibleSiteResourceIds = accessibleSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        } else {
+            const allOrgSiteResources = await db
+                .select({ siteResourceId: siteResources.siteResourceId })
+                .from(siteResources)
+                .where(eq(siteResources.orgId, orgId));
+            accessibleSiteResourceIds = allOrgSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        }
+
+        const conditions = [
+            and(
+                eq(siteResources.orgId, orgId),
+                inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
+            )
+        ];
 
         if (siteId != null) {
             // Keep inner joins here: filtering by a specific site implies the

server/routers/siteResource/listSiteResources.ts

@@ -1,11 +1,17 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, networks, siteNetworks } from "@server/db";
+import {
+    db,
+    networks,
+    roleSiteResources,
+    siteNetworks,
+    userSiteResources
+} from "@server/db";
 import { siteResources, sites, SiteResource } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { and, asc, desc, eq } from "drizzle-orm";
+import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -159,10 +165,47 @@ export async function listSiteResources(
             return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
         }
 
+        let accessibleSiteResourceIds: number[];
+        if (req.user) {
+            const accessibleSiteResources = await db
+                .select({
+                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
+                })
+                .from(userSiteResources)
+                .fullJoin(
+                    roleSiteResources,
+                    eq(
+                        userSiteResources.siteResourceId,
+                        roleSiteResources.siteResourceId
+                    )
+                )
+                .where(
+                    or(
+                        eq(userSiteResources.userId, req.user.userId),
+                        inArray(
+                            roleSiteResources.roleId,
+                            req.userOrgRoleIds ?? []
+                        )
+                    )
+                );
+            accessibleSiteResourceIds = accessibleSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        } else {
+            const allOrgSiteResources = await db
+                .select({ siteResourceId: siteResources.siteResourceId })
+                .from(siteResources)
+                .where(eq(siteResources.orgId, orgId));
+            accessibleSiteResourceIds = allOrgSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        }
+
         // Get site resources by joining networks to siteResources via siteNetworks
         const conditions = [
             eq(siteNetworks.siteId, siteId),
-            eq(siteResources.orgId, orgId)
+            eq(siteResources.orgId, orgId),
+            inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
         ];
 
         if (typeof status !== "undefined") {

server/routers/user/acceptInvite.ts

@@ -22,6 +22,7 @@ import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsFor
 import { build } from "@server/build";
 import { assignUserToOrg } from "@server/lib/userOrg";
 import { isOrgRebuildRateLimited } from "@server/lib/rebuildClientAssociations";
+import { UserType } from "@server/types/UserTypes";
 
 const acceptInviteBodySchema = z.strictObject({
     token: z.string(),
@@ -66,12 +67,17 @@ export async function acceptInvite(
             );
         }
 
-        const existingUser = await db
+        const [existingInternalUser] = await db
             .select()
             .from(users)
-            .where(eq(users.email, existingInvite.email))
+            .where(
+                and(
+                    eq(users.email, existingInvite.email),
+                    eq(users.type, UserType.Internal)
+                )
+            )
             .limit(1);
-        if (!existingUser.length) {
+        if (!existingInternalUser) {
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
@@ -80,9 +86,8 @@ export async function acceptInvite(
             );
         }
 
-        const { user, session } = await verifySession(req);
+        const { user } = await verifySession(req);
 
-        // at this point we know the user exists
         if (!user) {
             return next(
                 createHttpError(
@@ -92,7 +97,7 @@ export async function acceptInvite(
             );
         }
 
-        if (user && user.email !== existingInvite.email) {
+        if (user.email !== existingInvite.email) {
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
@@ -101,6 +106,15 @@ export async function acceptInvite(
             );
         }
 
+        if (user.type !== UserType.Internal) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Invites can only be accepted by internal users."
+                )
+            );
+        }
+
         if (build == "saas") {
             const usage = await usageService.getUsage(
                 existingInvite.orgId,
@@ -195,7 +209,7 @@ export async function acceptInvite(
             await assignUserToOrg(
                 org,
                 {
-                    userId: existingUser[0].userId,
+                    userId: user.userId,
                     orgId: existingInvite.orgId
                 },
                 inviteRoleIds,
@@ -208,13 +222,13 @@ export async function acceptInvite(
                 .where(eq(userInvites.inviteId, inviteId));
 
             logger.debug(
-                `User ${existingUser[0].userId} accepted invite to org ${existingInvite.orgId}`
+                `User ${user.userId} accepted invite to org ${existingInvite.orgId}`
             );
         });
 
-        calculateUserClientsForOrgs(existingUser[0].userId).catch((e) => {
+        calculateUserClientsForOrgs(user.userId).catch((e) => {
             logger.error(
-                `Failed to calculate user clients after accepting invite for user ${existingUser[0].userId}: ${e}`
+                `Failed to calculate user clients after accepting invite for user ${user.userId}: ${e}`
             );
         });
 

server/routers/user/createOrgUser.ts

@@ -20,6 +20,7 @@ import { TierFeature, tierMatrix } from "@server/lib/billing/tierMatrix";
 import { assignUserToOrg } from "@server/lib/userOrg";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { isOrgRebuildRateLimited } from "@server/lib/rebuildClientAssociations";
+import { idpExistsForOrg } from "@server/lib/idp/idpExistsForOrg";
 
 const paramsSchema = z.strictObject({
     orgId: z.string().nonempty()
@@ -239,6 +240,16 @@ export async function createOrgUser(
                 );
             }
 
+            const providerExists = await idpExistsForOrg(idpId, orgId);
+            if (!providerExists) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Identity provider not found in this organization"
+                    )
+                );
+            }
+
             const [idpRes] = await db
                 .select()
                 .from(idp)

server/routers/user/listUsers.ts

@@ -107,7 +107,7 @@ const listUsersSchema = z.strictObject({
                 .filter((n) => Number.isInteger(n) && n > 0);
             const unique = [...new Set(nums)];
             return unique.length ? unique : undefined;
-        }, z.array(z.number().int().positive()).max(50).optional())
+        }, z.array(z.number().int().positive()).optional())
         .openapi({
             description:
                 "Filter users who have any of these role ids in the organization (repeat query param)"

server/setup/migrationsPg.ts

@@ -28,6 +28,7 @@ import m19 from "./scriptsPg/1.18.4";
 import m20 from "./scriptsPg/1.19.0";
 import m21 from "./scriptsPg/1.20.0";
 import m22 from "./scriptsPg/1.21.0";
+import m23 from "./scriptsPg/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -55,7 +56,8 @@ const migrations = [
     { version: "1.18.4", run: m19 },
     { version: "1.19.0", run: m20 },
     { version: "1.20.0", run: m21 },
-    { version: "1.21.0", run: m22 }
+    { version: "1.21.0", run: m22 },
+    { version: "1.21.1", run: m23 }
     // Add new migrations here as they are created
 ] as {
     version: string;

server/setup/migrationsSqlite.ts

@@ -47,6 +47,7 @@ import m41 from "./scriptsSqlite/1.19.0";
 import m42 from "./scriptsSqlite/1.19.1";
 import m43 from "./scriptsSqlite/1.20.0";
 import m44 from "./scriptsSqlite/1.21.0";
+import m45 from "./scriptsSqlite/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -91,7 +92,8 @@ const migrations = [
     { version: "1.19.0", run: m41 },
     { version: "1.19.1", run: m42 },
     { version: "1.20.0", run: m43 },
-    { version: "1.21.0", run: m44 }
+    { version: "1.21.0", run: m44 },
+    { version: "1.21.1", run: m45 }
     // Add new migrations here as they are created
 ] as const;
 

server/setup/scriptsPg/1.21.1.ts

@@ -0,0 +1,37 @@
+import { db } from "@server/db/pg/driver";
+import { sql } from "drizzle-orm";
+
+const version = "1.21.1";
+
+const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    try {
+        await db.execute(sql`BEGIN`);
+
+        for (const actionId of actionsToGrant) {
+            await db.execute(sql`
+                INSERT INTO "roleActions" ("roleId", "actionId", "orgId")
+                SELECT r."roleId", ${actionId}, r."orgId"
+                FROM "roles" r
+                WHERE COALESCE(r."isAdmin", false) = false
+                  AND NOT EXISTS (
+                    SELECT 1 FROM "roleActions" ra
+                    WHERE ra."roleId" = r."roleId"
+                      AND ra."actionId" = ${actionId}
+                      AND ra."orgId" = r."orgId"
+                  );
+            `);
+        }
+
+        await db.execute(sql`COMMIT`);
+        console.log(`Finished setup script ${version}`);
+    } catch (e) {
+        await db.execute(sql`ROLLBACK`);
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    }
+}

server/setup/scriptsSqlite/1.21.1.ts

@@ -0,0 +1,43 @@
+import { APP_PATH } from "@server/lib/consts";
+import Database from "better-sqlite3";
+import path from "path";
+
+const version = "1.21.1";
+
+const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    const location = path.join(APP_PATH, "db", "db.sqlite");
+    const db = new Database(location);
+
+    try {
+        db.transaction(() => {
+            const insertRoleAction = db.prepare(`
+                INSERT INTO 'roleActions' ("roleId", "actionId", "orgId")
+                SELECT r."roleId", ?, r."orgId"
+                FROM 'roles' r
+                WHERE COALESCE(r."isAdmin", 0) = 0
+                  AND NOT EXISTS (
+                    SELECT 1 FROM 'roleActions' ra
+                    WHERE ra."roleId" = r."roleId"
+                      AND ra."actionId" = ?
+                      AND ra."orgId" = r."orgId"
+                  );
+            `);
+
+            for (const actionId of actionsToGrant) {
+                insertRoleAction.run(actionId, actionId);
+            }
+        })();
+
+        console.log(`Finished setup script ${version}`);
+    } catch (e) {
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    } finally {
+        db.close();
+    }
+}

src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx

@@ -181,7 +181,7 @@ export default function NetworkingPage() {
                     <SettingsSectionDescription>
                         {t("remoteExitNodeNetworkingDescription")}
                         <a
-                            href="https://docs.pangolin.net/placeholder"
+                            href="https://docs.pangolin.net/manage/remote-node/backhaul"
                             target="_blank"
                             rel="noopener noreferrer"
                             className="text-primary hover:underline inline-flex items-center gap-1"

src/app/[orgId]/settings/access/users/[userId]/access-controls/page.tsx

@@ -38,18 +38,6 @@ import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
 
-const accessControlsFormSchema = z.object({
-    username: z.string(),
-    autoProvisioned: z.boolean(),
-    roles: z.array(
-        z.object({
-            id: z.string(),
-            text: z.string(),
-            isAdmin: z.boolean().optional()
-        })
-    )
-});
-
 export default function AccessControlsPage() {
     const { orgUser: user, updateOrgUser } = userOrgUserContext();
     const { user: sessionUser } = useUserContext();
@@ -69,6 +57,20 @@ export default function AccessControlsPage() {
             (build === "enterprise" && !isPaid) ||
             (build === "oss" && !isPaid));
 
+    const accessControlsFormSchema = z.object({
+        username: z.string(),
+        autoProvisioned: z.boolean(),
+        roles: z
+            .array(
+                z.object({
+                    id: z.string(),
+                    text: z.string(),
+                    isAdmin: z.boolean().optional()
+                })
+            )
+            .min(1, { message: t("accessRoleSelectPlease") })
+    });
+
     const form = useForm({
         resolver: zodResolver(accessControlsFormSchema),
         defaultValues: {
@@ -108,15 +110,6 @@ export default function AccessControlsPage() {
     async function executeSave() {
         const values = form.getValues();
 
-        if (values.roles.length === 0) {
-            toast({
-                variant: "destructive",
-                title: t("accessRoleRequired"),
-                description: t("accessRoleSelectPlease")
-            });
-            return;
-        }
-
         setIsSaving(true);
         try {
             const roleIds = values.roles.map((r) => parseInt(r.id, 10));
@@ -170,15 +163,6 @@ export default function AccessControlsPage() {
 
         const values = form.getValues();
 
-        if (values.roles.length === 0) {
-            toast({
-                variant: "destructive",
-                title: t("accessRoleRequired"),
-                description: t("accessRoleSelectPlease")
-            });
-            return;
-        }
-
         const willHaveAdminRole = values.roles.some((r) => r.isAdmin === true);
 
         const isRemovingOwnAdmin =

src/app/[orgId]/settings/access/users/create/page.tsx

@@ -237,10 +237,13 @@ export default function Page() {
                 return;
             }
 
+            const useOrgIdps =
+                build === "saas" || env.app.identityProviderMode === "org";
+
             const res = await api
                 .get<
                     AxiosResponse<ListIdpsResponse>
-                >(build === "saas" ? `/org/${orgId}/idp` : "/idp")
+                >(useOrgIdps ? `/org/${orgId}/idp` : "/idp")
                 .catch((e) => {
                     console.error(e);
                     toast({
@@ -301,8 +304,7 @@ export default function Page() {
     );
     const [isSubmittingExternal, setIsSubmittingExternal] = useState(false);
 
-    const loading =
-        isSubmittingInternal || isSubmittingExternal;
+    const loading = isSubmittingInternal || isSubmittingExternal;
 
     async function onSubmitInternal() {
         const isValid = await internalForm.trigger();

src/app/[orgId]/settings/clients/user/page.tsx

@@ -104,7 +104,9 @@ export default async function ClientsPage(props: ClientsPageProps) {
             archived: Boolean(client.archived),
             blocked: Boolean(client.blocked),
             approvalState: client.approvalState,
-            fingerprint
+            fingerprint,
+            firstSeen: client.firstSeen ?? null,
+            lastSeen: client.lastSeen ?? null
         };
     };
 

src/app/auth/login/page.tsx

@@ -91,6 +91,7 @@ export default async function Page(props: {
     let loginIdps: LoginFormIDP[] = [];
     let lastUsedIdpForSmartLogin: (LoginFormIDP & { orgId?: string }) | null =
         null;
+
     if (!useSmartLogin) {
         // Load IdPs for DashboardLoginForm (OSS or org-only IdP mode)
         if (build === "oss" || env.app.identityProviderMode !== "org") {
@@ -117,12 +118,12 @@ export default async function Page(props: {
                     `/idp/${persistedData.idpId}`
                 );
 
-                const idp = idpRes.data.data.idp;
+                const res = idpRes.data.data;
 
                 lastUsedIdpForSmartLogin = {
-                    idpId: idp.idpId,
-                    name: idp.name,
-                    variant: idp.type,
+                    idpId: res.idp.idpId,
+                    name: res.idp.name,
+                    variant: res.idpOidcConfig?.variant ?? res.idp.type,
                     orgId: persistedData.orgId,
                     lastUsed: true
                 };
@@ -192,7 +193,10 @@ export default async function Page(props: {
                                 redirect={redirectUrl}
                                 forceLogin={forceLogin}
                                 defaultUser={defaultUser}
-                                lastUsedIdp={lastUsedIdpForSmartLogin}
+                                inviteMode={isInvite}
+                                lastUsedIdp={
+                                    isInvite ? null : lastUsedIdpForSmartLogin
+                                }
                                 orgSignIn={
                                     !isInvite &&
                                     (build === "saas" ||
@@ -212,7 +216,7 @@ export default async function Page(props: {
             ) : (
                 <DashboardLoginForm
                     redirect={redirectUrl}
-                    idps={loginIdps}
+                    idps={isInvite ? [] : loginIdps}
                     forceLogin={forceLogin}
                     showOrgLogin={
                         !isInvite &&

src/components/ContactSalesBanner.tsx

@@ -24,19 +24,21 @@ export function ContactSalesBanner() {
                             <ExternalLink className="size-3.5 shrink-0" />
                         </Link>
                         {" " + t("contactSalesOr") + " "}
-                        <Link
-                            href="https://pangolin.net/contact"
-                            target="_blank"
-                            rel="noopener noreferrer"
-                            className="inline-flex items-center gap-1 font-medium text-black-600 underline"
-                        >
-                            {t("contactSalesContactUs")}
-                            <ExternalLink className="size-3.5 shrink-0" />
-                        </Link>
-                        .
+                        <span className="whitespace-nowrap">
+                            <Link
+                                href="https://pangolin.net/contact"
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                className="inline-flex items-center gap-1 font-medium text-black-600 underline"
+                            >
+                                {t("contactSalesContactUs")}
+                                <ExternalLink className="size-3.5 shrink-0" />
+                            </Link>
+                            .
+                        </span>
                     </span>
                 </div>
             </div>
         </div>
     );
-}
+}

src/components/DomainPicker.tsx

@@ -53,7 +53,7 @@ import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { usePaidStatus } from "@/hooks/usePaidStatus";
 import { TierFeature, tierMatrix } from "@server/lib/billing/tierMatrix";
 import { toUnicode } from "punycode";
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useUserContext } from "@app/hooks/useUserContext";
 
 type AvailableOption = {
@@ -166,8 +166,19 @@ export default function DomainPicker({
     const [selectedProvidedDomain, setSelectedProvidedDomain] =
         useState<AvailableOption | null>(null);
 
+    // Only run the initial base-domain selection once the domains have
+    // loaded. This must not re-run on later `defaultDomainId`/`defaultSubdomain`
+    // changes, because selecting a provided (namespace) domain calls
+    // onDomainChange(null), which the parent form echoes back as
+    // defaultDomainId/defaultSubdomain becoming undefined — re-running this
+    // effect on that change would immediately snap the selector back to the
+    // organization domain, making provided domains unselectable whenever one
+    // was already set.
+    const didSelectInitialDomainRef = useRef(false);
+
     useEffect(() => {
-        if (!loadingDomains) {
+        if (!loadingDomains && !didSelectInitialDomainRef.current) {
+            didSelectInitialDomainRef.current = true;
             let domainOptionToSelect: DomainOption | null = null;
             if (organizationDomains.length > 0) {
                 // Select the first organization domain or the one provided from props

src/components/IdpLoginButtons.tsx

@@ -26,12 +26,14 @@ type IdpLoginButtonsProps = {
     idps: LoginFormIDP[];
     redirect?: string;
     orgId?: string;
+    passOrgIdToOidcUrl?: boolean;
 };
 
 export default function IdpLoginButtons({
     idps,
     redirect,
-    orgId
+    orgId,
+    passOrgIdToOidcUrl = true
 }: IdpLoginButtonsProps) {
     const [error, setError] = useState<string | null>(null);
     const t = useTranslations();
@@ -68,12 +70,13 @@ export default function IdpLoginButtons({
 
         let redirectToUrl: string | undefined;
         try {
-            console.log("generating", idpId, redirect || "/", orgId);
+            const oidcOrgId = passOrgIdToOidcUrl ? orgId : undefined;
+            console.log("generating", idpId, redirect || "/", oidcOrgId);
             const safeRedirect = cleanRedirect(redirect || "/");
             const response = await generateOidcUrlProxy(
                 idpId,
                 safeRedirect,
-                orgId
+                oidcOrgId
             );
 
             if (response.error) {
@@ -114,59 +117,52 @@ export default function IdpLoginButtons({
 
             <div className="space-y-4">
                 {params.get("gotoapp") ? (
-                    <>
-                        <Button
-                            type="button"
-                            className="w-full"
-                            onClick={() => {
-                                goToApp();
-                            }}
-                        >
-                            {t("continueToApplication")}
-                        </Button>
-                    </>
+                    <Button
+                        type="button"
+                        className="w-full"
+                        onClick={() => {
+                            goToApp();
+                        }}
+                    >
+                        {t("continueToApplication")}
+                    </Button>
                 ) : (
-                    <>
-                        {idps.map((idp) => {
-                            const effectiveType =
-                                idp.variant || idp.name.toLowerCase();
+                    idps.map((idp) => {
+                        const effectiveType =
+                            idp.variant || idp.name.toLowerCase();
 
-                            return (
-                                <div
-                                    className="w-full relative"
+                        return (
+                            <div className="w-full relative" key={idp.idpId}>
+                                <Button
                                     key={idp.idpId}
+                                    type="button"
+                                    variant="outline"
+                                    className="w-full inline-flex items-center space-x-2  after:absolute after:inset-0 after:z-10"
+                                    onClick={() => {
+                                        startTransition(() =>
+                                            loginWithIdp(idp.idpId)
+                                        );
+                                    }}
+                                    disabled={loading}
+                                    loading={loading}
                                 >
-                                    <Button
-                                        key={idp.idpId}
-                                        type="button"
-                                        variant="outline"
-                                        className="w-full inline-flex items-center space-x-2  after:absolute after:inset-0 after:z-10"
-                                        onClick={() => {
-                                            startTransition(() =>
-                                                loginWithIdp(idp.idpId)
-                                            );
-                                        }}
-                                        disabled={loading}
-                                        loading={loading}
-                                    >
-                                        <IdpTypeIcon
-                                            type={effectiveType}
-                                            size={16}
-                                        />
-                                        <span>{idp.name}</span>
-                                    </Button>
+                                    <IdpTypeIcon
+                                        type={effectiveType}
+                                        size={16}
+                                    />
+                                    <span>{idp.name}</span>
+                                </Button>
 
-                                    {idp.lastUsed && (
-                                        <div className="absolute inset-0">
-                                            <span className="absolute top-0 right-0 text-xs bg-primary text-primary-foreground rounded-bl-sm rounded-tr-sm px-2 py-0.5">
-                                                {t("idpLastUsed")}
-                                            </span>
-                                        </div>
-                                    )}
-                                </div>
-                            );
-                        })}
-                    </>
+                                {idp.lastUsed && (
+                                    <div className="absolute inset-0">
+                                        <span className="absolute top-0 right-0 text-xs bg-primary text-primary-foreground rounded-bl-sm rounded-tr-sm px-2 py-0.5">
+                                            {t("idpLastUsed")}
+                                        </span>
+                                    </div>
+                                )}
+                            </div>
+                        );
+                    })
                 )}
             </div>
         </div>

src/components/IdpTypeIcon.tsx

@@ -23,6 +23,8 @@ export default function IdpTypeIcon({
 }: Props) {
     const effectiveType = (variant || type || "").toLowerCase();
 
+    console.log(`[IdpTypeIcon]`, { effectiveType, variant, type });
+
     let src: string | null = null;
     let defaultAlt = "";
 

src/components/InviteStatusCard.tsx

@@ -44,6 +44,7 @@ export default function InviteStatusCard({
         | "user_does_not_exist"
         | "not_logged_in"
         | "user_limit_exceeded"
+        | "oidc_not_allowed"
     >("rejected");
 
     useEffect(() => {
@@ -69,6 +70,12 @@ export default function InviteStatusCard({
             function cardType() {
                 if (error.includes("Invite is not for this user")) {
                     return "wrong_user";
+                } else if (
+                    error.includes(
+                        "Invites can only be accepted by internal users."
+                    )
+                ) {
+                    return "oidc_not_allowed";
                 } else if (
                     error.includes(
                         "User does not exist. Please create an account first."
@@ -166,6 +173,14 @@ export default function InviteStatusCard({
                     <p className="text-center">{t("inviteCreateUser")}</p>
                 </div>
             );
+        } else if (type === "oidc_not_allowed") {
+            return (
+                <div>
+                    <p className="text-center mb-4">
+                        {t("inviteErrorOidcNotAllowed")}
+                    </p>
+                </div>
+            );
         } else if (type === "user_limit_exceeded") {
             return (
                 <div>
@@ -199,6 +214,10 @@ export default function InviteStatusCard({
             );
         } else if (type === "user_does_not_exist") {
             return <Button onClick={goToSignup}>{t("createAnAccount")}</Button>;
+        } else if (type === "oidc_not_allowed") {
+            return (
+                <Button onClick={goToLogin}>{t("inviteLogInOtherUser")}</Button>
+            );
         } else if (type === "user_limit_exceeded") {
             return (
                 <Button

src/components/MfaInputForm.tsx

@@ -13,7 +13,7 @@ import {
 import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import { REGEXP_ONLY_DIGITS } from "input-otp";
+import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
 
 const MFA_OTP_INPUT_ID = "mfa-otp-code";
 
@@ -82,9 +82,11 @@ export default function MfaInputForm({
                                             maxLength={6}
                                             {...field}
                                             autoComplete="one-time-code"
-                                            inputMode="numeric"
+                                            inputMode="text"
                                             autoFocus
-                                            pattern={REGEXP_ONLY_DIGITS}
+                                            pattern={
+                                                REGEXP_ONLY_DIGITS_AND_CHARS
+                                            }
                                             onChange={(value: string) => {
                                                 field.onChange(value);
                                                 if (value.length === 6) {

src/components/OrgIdpTable.tsx

@@ -1,17 +1,6 @@
 "use client";
 
-import { ColumnDef } from "@tanstack/react-table";
-import { ExtendedColumnDef } from "@app/components/ui/data-table";
-import { IdpDataTable } from "@app/components/OrgIdpDataTable";
-import { Button } from "@app/components/ui/button";
-import {
-    Command,
-    CommandEmpty,
-    CommandGroup,
-    CommandInput,
-    CommandItem,
-    CommandList
-} from "@app/components/ui/command";
+import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import {
     Credenza,
     CredenzaBody,
@@ -22,37 +11,42 @@ import {
     CredenzaHeader,
     CredenzaTitle
 } from "@app/components/Credenza";
+import { isIdpGlobalModeBannerVisible } from "@app/components/IdpGlobalModeBanner";
+import IdpTypeBadge from "@app/components/IdpTypeBadge";
+import IdpTypeIcon from "@app/components/IdpTypeIcon";
+import { IdpDataTable } from "@app/components/OrgIdpDataTable";
+import { Badge } from "@app/components/ui/badge";
+import { Button } from "@app/components/ui/button";
 import {
-    ArrowRight,
-    ArrowUpDown,
-    MoreHorizontal
-} from "lucide-react";
-import { useMemo, useState } from "react";
-import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import { toast } from "@app/hooks/useToast";
-import { formatAxiosError } from "@app/lib/api";
-import { createApiClient } from "@app/lib/api";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { useUserContext } from "@app/hooks/useUserContext";
-import { useRouter } from "next/navigation";
+    Command,
+    CommandEmpty,
+    CommandGroup,
+    CommandInput,
+    CommandItem,
+    CommandList
+} from "@app/components/ui/command";
+import { ExtendedColumnDef } from "@app/components/ui/data-table";
 import {
     DropdownMenu,
     DropdownMenuContent,
     DropdownMenuItem,
     DropdownMenuTrigger
 } from "@app/components/ui/dropdown-menu";
-import Link from "next/link";
-import { useTranslations } from "next-intl";
-import IdpTypeBadge from "@app/components/IdpTypeBadge";
-import IdpTypeIcon from "@app/components/IdpTypeIcon";
-import { useQuery } from "@tanstack/react-query";
-import { useDebounce } from "use-debounce";
-import type { ListUserAdminOrgIdpsResponse } from "@server/routers/orgIdp/types";
-import { cn } from "@app/lib/cn";
-import { Badge } from "@app/components/ui/badge";
+import { useEnvContext } from "@app/hooks/useEnvContext";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { toast } from "@app/hooks/useToast";
+import { useUserContext } from "@app/hooks/useUserContext";
+import { createApiClient, formatAxiosError } from "@app/lib/api";
+import { cn } from "@app/lib/cn";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import { isIdpGlobalModeBannerVisible } from "@app/components/IdpGlobalModeBanner";
+import type { ListUserAdminOrgIdpsResponse } from "@server/routers/orgIdp/types";
+import { useQuery } from "@tanstack/react-query";
+import { ArrowRight, ArrowUpDown, MoreHorizontal } from "lucide-react";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useMemo, useState } from "react";
+import { useDebounce } from "use-debounce";
 
 export type IdpRow = {
     idpId: number;
@@ -483,15 +477,17 @@ export default function IdpTable({ idps, orgId }: Props) {
                                                     {group.name}
                                                 </div>
                                                 <div className="mt-1 flex flex-wrap gap-1">
-                                                    {group.sources.map((src) => (
-                                                        <Badge
-                                                            key={src.orgId}
-                                                            variant="secondary"
-                                                            className="max-w-full truncate font-normal"
-                                                        >
-                                                            {src.orgName}
-                                                        </Badge>
-                                                    ))}
+                                                    {group.sources.map(
+                                                        (src) => (
+                                                            <Badge
+                                                                key={src.orgId}
+                                                                variant="secondary"
+                                                                className="max-w-full truncate font-normal"
+                                                            >
+                                                                {src.orgName}
+                                                            </Badge>
+                                                        )
+                                                    )}
                                                 </div>
                                             </div>
                                         </CommandItem>

src/components/OrgInfoCard.tsx

@@ -8,6 +8,7 @@ import {
     InfoSections,
     InfoSectionTitle
 } from "@app/components/InfoSection";
+import CopyToClipboard from "@app/components/CopyToClipboard";
 import { useTranslations } from "next-intl";
 
 type OrgInfoCardProps = {};
@@ -26,7 +27,9 @@ export default function OrgInfoCard({}: OrgInfoCardProps) {
                     </InfoSection>
                     <InfoSection>
                         <InfoSectionTitle>{t("orgId")}</InfoSectionTitle>
-                        <InfoSectionContent>{org.org.orgId}</InfoSectionContent>
+                        <InfoSectionContent>
+                            <CopyToClipboard text={org.org.orgId} />
+                        </InfoSectionContent>
                     </InfoSection>
                     <InfoSection>
                         <InfoSectionTitle>{t("subnet")}</InfoSectionTitle>

src/components/OrgRolesTagField.tsx

@@ -9,17 +9,15 @@ import {
     FormMessage
 } from "@app/components/ui/form";
 
-import { toast } from "@app/hooks/useToast";
 import { useTranslations } from "next-intl";
 
-import { useRef } from "react";
 import type { FieldValues, Path, UseFormReturn } from "react-hook-form";
 import { RolesSelector, type SelectedRole } from "./roles-selector";
 
 type OrgRolesTagFieldProps<TFieldValues extends FieldValues> = {
     form: Pick<
         UseFormReturn<TFieldValues>,
-        "control" | "getValues" | "setValue"
+        "control" | "getValues" | "setValue" | "clearErrors"
     >;
     orgId: string;
     /** Field in the form that holds Tag[] (role tags). Default: `"roles"`. */
@@ -42,46 +40,6 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
     disabled
 }: OrgRolesTagFieldProps<TFieldValues>) {
     const t = useTranslations();
-    const isPopoverOpenRef = useRef(false);
-    const lastValidRolesRef = useRef<SelectedRole[]>(
-        (form.getValues(name) as SelectedRole[]) ?? []
-    );
-
-    function validateRolesSelection() {
-        const current = form.getValues(name) as SelectedRole[];
-
-        if (current.length === 0 && lastValidRolesRef.current.length > 0) {
-            form.setValue(name, lastValidRolesRef.current as never, {
-                shouldDirty: true
-            });
-            toast({
-                variant: "destructive",
-                title: t("accessRoleRequired"),
-                description: t("accessRoleSelectPlease")
-            });
-            return false;
-        }
-
-        if (current.length > 0) {
-            lastValidRolesRef.current = current;
-        }
-
-        return true;
-    }
-
-    function handlePopoverOpenChange(open: boolean) {
-        isPopoverOpenRef.current = open;
-
-        if (open) {
-            const current = form.getValues(name) as SelectedRole[];
-            if (current.length > 0) {
-                lastValidRolesRef.current = current;
-            }
-            return;
-        }
-
-        validateRolesSelection();
-    }
 
     function setRoleTags(nextValue: SelectedRole[]) {
         const prev = form.getValues(name) as SelectedRole[];
@@ -99,15 +57,14 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
             form.setValue(name, [prev[prev.length - 1]] as never, {
                 shouldDirty: true
             });
+            form.clearErrors(name);
             return;
         }
 
         form.setValue(name, next as never, { shouldDirty: true });
 
-        if (next.length > 0 && !isPopoverOpenRef.current) {
-            lastValidRolesRef.current = next;
-        } else if (!isPopoverOpenRef.current) {
-            validateRolesSelection();
+        if (next.length > 0) {
+            form.clearErrors(name);
         }
     }
 
@@ -117,9 +74,6 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
             name={name}
             render={({ field }) => {
                 const selectedRoles = (field.value ?? []) as SelectedRole[];
-                if (!isPopoverOpenRef.current && selectedRoles.length > 0) {
-                    lastValidRolesRef.current = selectedRoles;
-                }
 
                 return (
                     <FormItem className="flex flex-col items-start">
@@ -129,7 +83,6 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
                                 orgId={orgId}
                                 selectedRoles={selectedRoles}
                                 onSelectRoles={setRoleTags}
-                                onPopoverOpenChange={handlePopoverOpenChange}
                                 disabled={disabled}
                             />
                         </FormControl>

src/components/PermissionsSelectBox.tsx

@@ -115,8 +115,11 @@ function getActionsCategories(root: boolean) {
         },
 
         "Resource Policy": {
+            [t("actionListResourcePolicies")]: "listResourcePolicies",
+            [t("actionCreateResourcePolicy")]: "createResourcePolicy",
             [t("actionGetResourcePolicy")]: "getResourcePolicy",
             [t("actionUpdateResourcePolicy")]: "updateResourcePolicy",
+            [t("actionDeleteResourcePolicy")]: "deleteResourcePolicy",
             [t("actionSetResourcePolicyUsers")]: "setResourcePolicyUsers",
             [t("actionSetResourcePolicyRoles")]: "setResourcePolicyRoles",
             [t("actionSetResourcePolicyPassword")]: "setResourcePolicyPassword",

src/components/SmartLoginForm.tsx

@@ -56,6 +56,7 @@ type SmartLoginFormProps = {
     defaultUser?: string;
     orgSignIn?: OrgSignInConfig;
     lastUsedIdp?: (LoginFormIDP & { orgId?: string }) | null;
+    inviteMode?: boolean;
 };
 
 type ViewState =
@@ -93,7 +94,8 @@ export default function SmartLoginForm({
     forceLogin,
     defaultUser,
     orgSignIn,
-    lastUsedIdp
+    lastUsedIdp,
+    inviteMode = false
 }: SmartLoginFormProps) {
     const router = useRouter();
     const { env } = useEnvContext();
@@ -136,6 +138,10 @@ export default function SmartLoginForm({
             return;
         }
 
+        const signupUrl = redirect
+            ? `/auth/signup?email=${encodeURIComponent(identifier)}&redirect=${encodeURIComponent(redirect)}&fromSmartLogin=true`
+            : `/auth/signup?email=${encodeURIComponent(identifier)}&fromSmartLogin=true`;
+
         if (!result.found || result.accounts.length === 0) {
             // No accounts found
             if (!isEmail || forceLogin) {
@@ -147,13 +153,36 @@ export default function SmartLoginForm({
                 return;
             }
             // Valid email but no accounts and not forceLogin - redirect to signup
-            const signupUrl = redirect
-                ? `/auth/signup?email=${encodeURIComponent(identifier)}&redirect=${encodeURIComponent(redirect)}&fromSmartLogin=true`
-                : `/auth/signup?email=${encodeURIComponent(identifier)}&fromSmartLogin=true`;
             router.push(signupUrl);
             return;
         }
 
+        // Invite accept only supports internal (password) accounts
+        if (inviteMode) {
+            const internalAccount = result.accounts.find(
+                (acc) => acc.hasInternalAuth
+            );
+            if (internalAccount) {
+                setViewState({
+                    type: "password",
+                    identifier,
+                    account: internalAccount
+                });
+                return;
+            }
+
+            if (isEmail && !forceLogin) {
+                router.push(signupUrl);
+                return;
+            }
+
+            form.setError("identifier", {
+                type: "manual",
+                message: t("inviteLoginInternalOnly")
+            });
+            return;
+        }
+
         // Determine which view to show
         const account = result.accounts[0]; // Use first account for now
 
@@ -303,6 +332,7 @@ export default function SmartLoginForm({
                             <IdpLoginButtons
                                 idps={[lastUsedIdp]}
                                 orgId={lastUsedIdp.orgId}
+                                passOrgIdToOidcUrl={false}
                                 redirect={redirect}
                             />
                         )}

src/components/UptimeBar.tsx

@@ -134,7 +134,9 @@ export default function UptimeBar({
 
     if (!data) return null;
 
-    const allNoData = data.days.every((d) => d.status === "no_data");
+    const allNoData = data.days.every(
+        (d) => d.status === "no_data" || d.status === "unknown"
+    );
 
     return (
         <div className={cn("space-y-3", className)}>

src/components/UptimeMiniBar.tsx

@@ -124,7 +124,9 @@ export function UptimeMiniBar({
 
     if (!data) return null;
 
-    const allNoData = data.days.every((d) => d.status === "no_data");
+    const allNoData = data.days.every(
+        (d) => d.status === "no_data" || d.status === "unknown"
+    );
 
     return (
         <div className="flex items-center gap-2">

src/components/UserDevicesTable.tsx

@@ -77,6 +77,8 @@ export type ClientRow = {
         username: string | null;
         hostname: string | null;
     } | null;
+    firstSeen: number | null;
+    lastSeen: number | null;
 };
 
 type ClientTableProps = {
@@ -112,7 +114,9 @@ export default function UserDevicesTable({
 
     const defaultUserColumnVisibility = {
         subnet: false,
-        niceId: false
+        niceId: false,
+        firstSeen: false,
+        lastSeen: false
     };
 
     const refreshData = () => {
@@ -621,6 +625,68 @@ export default function UserDevicesTable({
                 accessorKey: "subnet",
                 friendlyName: t("address"),
                 header: () => <span className="px-3">{t("address")}</span>
+            },
+            {
+                accessorKey: "firstSeen",
+                friendlyName: t("firstSeen"),
+                header: () => {
+                    const firstSeenOrder = getSortDirection(
+                        "firstSeen",
+                        searchParams
+                    );
+
+                    const Icon =
+                        firstSeenOrder === "asc"
+                            ? ArrowDown01Icon
+                            : firstSeenOrder === "desc"
+                              ? ArrowUp10Icon
+                              : ChevronsUpDownIcon;
+                    return (
+                        <Button
+                            variant="ghost"
+                            onClick={() => toggleSort("firstSeen")}
+                        >
+                            {t("firstSeen")}
+                            <Icon className="ml-2 h-4 w-4" />
+                        </Button>
+                    );
+                },
+                cell: ({ row }) => {
+                    const firstSeen = row.original.firstSeen;
+                    if (!firstSeen) return "-";
+                    return new Date(firstSeen * 1000).toLocaleString();
+                }
+            },
+            {
+                accessorKey: "lastSeen",
+                friendlyName: t("lastSeen"),
+                header: () => {
+                    const lastSeenOrder = getSortDirection(
+                        "lastSeen",
+                        searchParams
+                    );
+
+                    const Icon =
+                        lastSeenOrder === "asc"
+                            ? ArrowDown01Icon
+                            : lastSeenOrder === "desc"
+                              ? ArrowUp10Icon
+                              : ChevronsUpDownIcon;
+                    return (
+                        <Button
+                            variant="ghost"
+                            onClick={() => toggleSort("lastSeen")}
+                        >
+                            {t("lastSeen")}
+                            <Icon className="ml-2 h-4 w-4" />
+                        </Button>
+                    );
+                },
+                cell: ({ row }) => {
+                    const lastSeen = row.original.lastSeen;
+                    if (!lastSeen) return "-";
+                    return new Date(lastSeen * 1000).toLocaleString();
+                }
             }
         ];
 

src/components/resource-launcher/LauncherOrgSelector.tsx

@@ -15,11 +15,14 @@ import {
 } from "@app/components/ui/popover";
 import { cn } from "@app/lib/cn";
 import { ListUserOrgsResponse } from "@server/routers/org";
-import { Check, ChevronDown, ChevronsUpDown } from "lucide-react";
+import { Check, ChevronDown, Plus } from "lucide-react";
 import { usePathname, useRouter } from "next/navigation";
 import { useMemo, useState } from "react";
 import { useTranslations } from "next-intl";
 import { Button } from "@app/components/ui/button";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useUserContext } from "@app/hooks/useUserContext";
+import { build } from "@server/build";
 
 type LauncherOrgSelectorProps = {
     orgId?: string;
@@ -31,9 +34,16 @@ export function LauncherOrgSelector({ orgId, orgs }: LauncherOrgSelectorProps) {
     const router = useRouter();
     const pathname = usePathname();
     const t = useTranslations();
+    const { env } = useEnvContext();
+    const { user } = useUserContext();
 
     const selectedOrg = orgs?.find((org) => org.orgId === orgId);
 
+    let canCreateOrg = !env.flags.disableUserCreateOrg || user.serverAdmin;
+    if (build === "saas" && user.type !== "internal") {
+        canCreateOrg = false;
+    }
+
     const sortedOrgs = useMemo(() => {
         if (!orgs?.length) {
             return orgs ?? [];
@@ -108,6 +118,22 @@ export function LauncherOrgSelector({ orgId, orgs }: LauncherOrgSelectorProps) {
                         </CommandGroup>
                     </CommandList>
                 </Command>
+                {canCreateOrg && (
+                    <div className="p-2 border-t border-border">
+                        <Button
+                            variant="ghost"
+                            size="sm"
+                            className="w-full justify-start h-8 font-normal text-muted-foreground"
+                            onClick={() => {
+                                setOpen(false);
+                                router.push("/setup");
+                            }}
+                        >
+                            <Plus className="h-3.5 w-3.5 mr-2" />
+                            {t("setupNewOrg")}
+                        </Button>
+                    </div>
+                )}
             </PopoverContent>
         </Popover>
     );

src/hooks/useCertificate.ts

@@ -111,7 +111,8 @@ export function useCertificate({
     let certError: string | null = null;
     if (restartCert.isError) {
         certError = "Failed to restart";
-    } else if (isError) {
+    } else if (isError || (!isLoading && data === null)) {
+        // Null value means failed to get the certificate
         certError = "Failed";
     }
 

src/lib/queries.ts

@@ -1,4 +1,10 @@
+import type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
+import { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
 import { build } from "@server/build";
+import {
+    StatusHistoryResponse,
+    type BatchedStatusHistoryResponse
+} from "@server/lib/statusHistory";
 import type { ListAlertRulesResponse } from "@server/routers/alertRule/types";
 import type { QueryRequestAnalyticsResponse } from "@server/routers/auditLogs";
 import type {
@@ -7,6 +13,7 @@ import type {
     QueryConnectionAuditLogResponse,
     QueryRequestAuditLogResponse
 } from "@server/routers/auditLogs/types";
+import type { GetCertificateResponse } from "@server/routers/certificates/types";
 import type {
     ListClientsResponse,
     ListUserDevicesResponse
@@ -16,15 +23,30 @@ import type {
     ListDomainsResponse
 } from "@server/routers/domain";
 import type { GetDomainResponse } from "@server/routers/domain/getDomain";
+import { ListHealthChecksResponse } from "@server/routers/healthChecks/types";
+import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
+import type {
+    LauncherResource,
+    ListLauncherGroupsResponse,
+    ListLauncherLabelsResponse,
+    ListLauncherResourcesResponse,
+    ListLauncherScaleResponse,
+    ListLauncherSitesResponse,
+    ListLauncherViewsResponse
+} from "@server/routers/launcher/types";
+import type { GetResourcePolicyResponse } from "@server/routers/policy";
 import type {
-    GetResourceWhitelistResponse,
     GetResourcePoliciesResponse,
+    GetResourceWhitelistResponse,
     ListResourceNamesResponse,
-    ListResourcesResponse,
     ListResourceRolesResponse,
     ListResourceRulesResponse,
+    ListResourcesResponse,
     ListResourceUsersResponse
 } from "@server/routers/resource";
+import type { GetResourceResponse } from "@server/routers/resource/getResource";
+import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getResourceAuthInfo";
+import type { ListResourcePoliciesResponse } from "@server/routers/resource/types";
 import type { ListRolesResponse } from "@server/routers/role";
 import type { ListSitesResponse } from "@server/routers/site";
 import type {
@@ -33,6 +55,7 @@ import type {
     ListSiteResourceRolesResponse,
     ListSiteResourceUsersResponse
 } from "@server/routers/siteResource";
+import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
 import type { ListTargetsResponse } from "@server/routers/target";
 import type { ListUsersResponse } from "@server/routers/user";
 import type ResponseT from "@server/types/Response";
@@ -42,37 +65,12 @@ import {
     queryOptions
 } from "@tanstack/react-query";
 import { isAxiosError, type AxiosResponse } from "axios";
-import z, { meta } from "zod";
+import z from "zod";
 import { remote } from "./api";
 import { durationToMs } from "./durationToMs";
-import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
-import { ListHealthChecksResponse } from "@server/routers/healthChecks/types";
-import {
-    StatusHistoryResponse,
-    type BatchedStatusHistoryResponse
-} from "@server/lib/statusHistory";
-import type { ListResourcePoliciesResponse } from "@server/routers/resource/types";
-import type { GetResourcePolicyResponse } from "@server/routers/policy";
-import type {
-    ListLauncherGroupsResponse,
-    ListLauncherLabelsResponse,
-    ListLauncherResourcesResponse,
-    ListLauncherScaleResponse,
-    ListLauncherSitesResponse,
-    ListLauncherViewsResponse,
-    LauncherListQuery,
-    LauncherResource,
-    LauncherViewConfig
-} from "@server/routers/launcher/types";
-import type { GetResourceResponse } from "@server/routers/resource/getResource";
-import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getResourceAuthInfo";
-import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
-import type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
-import { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
-import type { GetCertificateResponse } from "@server/routers/certificates/types";
 
-export type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 export { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
+export type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 
 export type ProductUpdate = {
     link: string | null;